Help for unknown protector

Newbie_Cracker · #1 12-28-2010, 18:44

It's not too hard to unpack, I didn't work on its API redirection routine yet. Because It's too easy to crack using a loader !!

I just want to know the name of protector.

Anyways, thanks Archer.

uLysse · #2 12-28-2010, 21:24

It's Obsidium v1.4

API redirections like that :

Code:

003E1858   60                   PUSHAD
003E1859   9C                   PUSHFD
003E185A   66:BD F6AD           MOV BP,0ADF6
003E185E   EB 03                JMP SHORT 003E1863
003E1860   0253 24              ADD DL,BYTE PTR DS:[EBX+24]
003E1863   66:BB 0E99           MOV BX,990E
003E1867  -E9 752EFDFF          JMP 003B46E1

are typical of Obsidium.

And this (mov reg32, API / nop) :

Code:

00A268C6   . BB 49AA807C    MOV EBX,kernel32.GetProcessHeap
00A268CB   . 90             NOP
00A268CC   . FFD3           CALL EBX                                 ; [GetProcessHeap

is typical of the 1.4 version of Obsidium

Newbie_Cracker · #3 01-11-2011, 17:42

Quote:

Originally Posted by uLysse

It's Obsidium v1.4

Thanks bro.

I will work on it.

Regards.

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Best software protector: Themida or Enigma Protector?	smartins	General Discussion	13	04-27-2010 17:58
New or Unknown Protector	lordnasty	General Discussion	0	06-19-2006 16:57
How to defeat Password Reminder 1.6 ? (An unknown protector)	Newbie_Cracker	General Discussion	17	02-17-2005 04:49

The Following User Gave Reputation+1 to uLysse For This Useful Post:
Newbie_Cracker (01-11-2011)